Help on a REX extract - and count

[LizAndy123]

So I have an Index

Index= xxxxxx "Stopping iteration"

I have the rex for getting the unique Id

Event Sample : Stopping iteration - 1900000000: 2000 Files accepted

so my current REX is rex "Stopping\siteration[\s\-]+(?<stop_reg_id>[^:\s]+)" and it extracts the 1900000000

I want to extract the 2000 number and then do a count for 24 hours.

Any help would be great

[richgalloway]

It would help to know what you've tried so far, but getting the other field is just a matter of extending the regex.

"Stopping\siteration[\s\-]+(?<stop_reg_id>[^:\s]+):\s*(?<file_count>\d+)"

[LizAndy123]

Thanks

This helps extracting the number - how do I do the sum at the end ?

in 24 hours I could have 96 * 2000 file uploads

[richgalloway · Accepted solution]

One way is with addcoltotals

| rex "..."
``` more query stuff```
| addcoltotals file_count

[LizAndy123]

Hey Rich that works and I get the total at the bottom but it shows every single column also.

Example I had 98 Events and total was 157,000 but it shows every single event and the columns

[richgalloway]

If all you want is a single integer that is the total of all file_count values then stats is the way to go.

| rex "..."
``` more query stuff ```
| stats sum(file_count) as Total_Count

[LizAndy123]

So basically I need the total number of files I uploaded in a 24 hour period once I get that figure extracted